UAC-0050 Targets European Financial Institution Using Trusted Services And Remote Administration Software

In February 2026, researchers observed a new spear-phishing campaign attributed to UAC-0050 (Mercenary Akula) targeting a European financial institution supporting Ukraine-related development initiatives. Unlike traditional malware campaigns that rely on sophisticated exploits, this operation demonstrates how threat actors continue to achieve successful compromises using trusted services, social engineering, and legitimate remote administration software

The campaign combines spoofed government-themed emails, public file-sharing platforms, layered password-protected archives, and legitimate remote access tools to bypass conventional security controls. While the techniques themselves are not new, the targeting of financial organizations outside the actor’s traditional victim profile signals a potentially broader operational focus

For financial institutions and organizations involved in government, procurement, or reconstruction projects, this campaign serves as a reminder that even well-known attack techniques remain highly effective when combined with convincing social engineering

Threat Overview

UAC-0050, publicly tracked by several threat intelligence organizations and also known as Mercenary Akula, has been active since at least 2020. The group is widely assessed to be a Russia-aligned mercenary threat actor with operations focused on cyber espionage, financial theft, and intelligence collection

Unlike many advanced threat groups that rely heavily on custom malware families, UAC-0050 consistently leverages legitimate software and publicly available infrastructure to achieve its objectives. This operational model allows the actor to minimize infrastructure development while blending malicious activity into normal enterprise traffic

Public reporting has linked the group to multiple aliases, including:

• UAC-0050
• Mercenary Akula
• DaVinci Group
• Agency DaVinci

Threat intelligence reporting, including assessments from CERT-UA, associates the group with Russian law enforcement interests and documents its continued targeting of Ukrainian government entities, administrative organizations, and financially relevant institutions

Historically, UAC-0050 has demonstrated expertise in:

• Targeted spear-phishing campaigns
• Trusted-brand impersonation
• Intelligence collection
• Financial fraud enablement
• Commercial remote access software abuse
• Information-psychological operations

Rather than relying solely on advanced malware development, the actor frequently combines legitimate cloud platforms, commercially available administration tools, and convincing social engineering to establish access while reducing opportunities for detection

Threat Actor Evolution

Over the past several years, UAC-0050 has gradually expanded both its operational capabilities and targeting priorities

Earlier campaigns primarily focused on Ukrainian governmental organizations and public-sector entities through phishing emails impersonating trusted institutions. Subsequent reporting throughout 2024 showed the actor broadening its objectives to include financially motivated operations while maintaining its espionage capabilities

Rather than changing its technical methodology, the actor refined existing techniques by abusing trusted cloud services and commercial software instead of deploying increasingly sophisticated malware

Public reporting has documented repeated abuse of services including:

• Dropbox
• Google Drive
• Bitbucket
• GitHub
• 4Sync
• Public file-sharing platforms

Likewise, commercial remote administration software has become a defining characteristic of the group’s operations. Previous campaigns have leveraged:

• Remote Manipulator System (RMS)
• LiteManager
• Remote Utilities
• Remcos RAT
• QuasarRAT
• NetSupport RAT

This consistent reliance on legitimate administration software significantly complicates defensive operations because network traffic generated by these applications often resembles authorized remote management activity

The February 2026 campaign continues this established pattern while introducing a strategically significant victim profile

Target Profile

The targeted organization was a European financial institution supporting Ukraine-linked development and reconstruction initiatives. The intended victim was a senior legal and policy advisor involved in procurement-related workflows. This role likely provided visibility into:

• Contracts and counterparties
• Approval chains
• Funding and payment processes
• Internal institutional decision-making
• Sensitive project or reconstruction documentation

This made the target relevant for both intelligence collection and potential follow-on fraud or payment diversion

Initial Access Vector

On 9 February 2026, the victim received a spear-phishing email with a court-themed lure. Public reporting describes the subject as:

“Request from the Chernihiv Administrative Court for Case #81435126”

The message was sent from a spoofed Ukrainian government-style sender, including:

• 4ml@chernigiv-rada[.]gov[.]ua

The email directed the victim to download an archive hosted on:

• pixeldrain[.]com

Related reporting also referenced a parallel sample using a spoofed Romanian sender associated with RPG Suceava, suggesting the actor was developing localized and role-relevant lure variants

Infection Chain and Technical Analysis

• Delivery and Archive Staging
  The attack used a multi-stage archive chain designed to complicate inspection and normalize suspicious user behavior:
  • Victim clicked a link in the spear-phishing email
  • A ZIP archive was downloaded from PixelDrain
  • The ZIP contained a nested RAR archive
  • The RAR contained a password-protected 7-Zip archive
  • A text file such as Code.txt / Код.txt supplied the password
  • The final payload appeared as a double-extension executable ending in .pdf.exe

This chain served several defensive-evasion purposes:

• • Reduced straightforward content inspection
  • Delayed user awareness of malicious intent
  • Used password protection to limit automated scanning
  • Leveraged document masquerading to increase execution likelihood

• Payload: Remote Manipulator System (RMS)

When the final payload was executed, it installed Remote Manipulator System (RMS), a legitimate remote administration solution developed by TektonIT. Public analysis of the installer reportedly identified strings and parameters associated with RMS deployment, including references to:

• rmansys[.]ru
• INSTALLDIR
• INTEGRATE_FIREWALL
• LAUNCHPROGRAM
• SHOW_SETTINGS
• MONITOR_DRIVER
• ISX_SERIALNUM

These artifacts suggest a preconfigured or unattended deployment path intended to establish remote-access functionality rapidly and with limited user interaction

Operationally, RMS provides the attacker with:

• Interactive remote access
• Persistent administration capability
• Opportunity for post-compromise reconnaissance
• Potential access to financial, legal, and procurement workflows
• A foothold that blends into benign remote-administration patterns better than custom malware

No software vulnerability exploitation or zero-day activity was identified in the supplied research. The intrusion relied on social engineering, trust abuse, and legitimate software misuse

• Malware, Tooling, and Tradecraft
  • Confirmed Tool in This Incident
    • Remote Manipulator System (RMS)
  • Broader UAC-0050 Tooling Pattern
    • Public reporting links UAC-0050 to repeated use of:
      • RMS / TEKTONITRMS
      • LiteManager
      • Remote Utilities
      • Remcos RAT
      • QuasarRAT
      • NetSupport RAT
  • Additional commodity or commercial remote-access tooling in prior campaigns

The strongest analytical takeaway is that UAC-0050 prefers low-friction, commercially available, or legitimate tooling that enables remote control while reducing the need for custom malware development and improving the chance of blending into expected administrative traffic

One of the defining characteristics of this campaign is the limited use of attacker-controlled infrastructure. Instead of hosting payloads on dedicated malicious servers, UAC-0050 relied heavily on trusted third-party services

• Incident-Linked Infrastructure

• Delivery Characteristics

The delivery methodology reflects several recurring characteristics observed across previous UAC-0050 campaigns:

• Impersonation of trusted government or administrative entities
• Abuse of legitimate public file-sharing platforms
• Delivery through layered password-protected archives
• Deployment of commercially available remote administration software
• Minimal exposure of dedicated attacker-controlled infrastructure

This operational model presents a significant challenge for defenders because each individual component may appear legitimate when viewed in isolation. Effective detection therefore depends on correlating activity across email, endpoint, identity, and network telemetry

Organizations using Microsoft Defender XDR and Microsoft Sentinel should monitor for behavioral indicators associated with phishing campaigns that abuse legitimate infrastructure and remote administration software

Particular attention should be given to:

• Emails impersonating government or judicial organizations
• Downloads originating from public file-sharing services such as PixelDrain
• Password-protected ZIP, RAR, and 7-Zip archives delivered through email
• Double-extension executable files (for example, .pdf.exe)
• Installation or execution of unauthorized remote administration software such as RMS
• Unexpected outbound communications initiated by remote administration tools
• Registry modifications establishing persistence
• Suspicious child processes launched from archive extraction utilities

Because the attack chain spans multiple security domains, organizations should correlate email telemetry, endpoint activity, process execution, network events, and identity signals to reconstruct the full intrusion lifecycle

Although this campaign did not exploit software vulnerabilities, several security controls can significantly reduce the likelihood of compromise

Recommended defensive measures include:

• Block or restrict executable attachments delivered through email
• Configure Microsoft Defender Attack Surface Reduction (ASR) rules to prevent suspicious child process creation
• Restrict downloads from unapproved public file-sharing platforms
• Display known file extensions on Windows systems to reduce double-extension abuse
• Implement application allowlisting to prevent unauthorized remote administration software
• Monitor enterprise environments for unexpected deployment of legitimate remote support tools
• Deliver regular phishing awareness training focused on archive-based delivery and trusted-brand impersonation
• Enforce Multi-Factor Authentication (MFA) for privileged and business-critical accounts

Although technically straightforward, this campaign reflects several broader trends shaping the current threat landscape

Rather than investing in increasingly sophisticated malware, threat actors continue abusing trusted cloud services, legitimate software, and carefully crafted social engineering to bypass traditional security controls

The campaign also highlights an evolution in victim selection. By targeting a financial institution supporting Ukraine-related reconstruction initiatives, UAC-0050 demonstrates an interest in organizations capable of providing both strategic intelligence and financial value

Operational Impact

A successful compromise could enable attackers to:

• Access procurement documentation
• Monitor legal and policy communications
• Collect sensitive reconstruction or funding information
• Conduct payment diversion or procurement fraud
• Maintain persistent access for long-term intelligence collection

Business Impact

Potential business consequences include:

• Financial losses resulting from fraud or transaction manipulation
• Exposure of confidential legal and financial information
• Disruption of procurement and reconstruction workflows
• Increased incident response and remediation costs
• Reputational damage among regulators, partners, and stakeholders

The February 2026 campaign demonstrates that successful cyber intrusions do not necessarily depend on advanced malware or zero-day exploits. Instead, attackers continue to achieve their objectives by abusing trusted services, legitimate software, and carefully tailored social engineering

The most significant takeaway is not the technical sophistication of the attack but the strategic value of the target. By focusing on a senior legal and procurement advisor within a financial institution supporting Ukraine-related initiatives, UAC-0050 maximized the potential intelligence and financial value of a successful compromise while maintaining a relatively low operational profile

For defenders, this reinforces the importance of adopting behavioral detection strategies that correlate email, endpoint, identity, and network telemetry rather than relying solely on signature-based detections. It also highlights the need to closely monitor the use of legitimate remote administration software, which continues to be abused by advanced threat actors to blend malicious activity with normal enterprise operations

As campaigns like UAC-0050 continue to abuse legitimate services and remote administration tools, organizations need proactive detection capabilities that go beyond traditional security controls. Wizard Cyber helps organizations stay ahead of these threats through:

• 24/7 Threat Monitoring via Microsoft Sentinel: Continuous monitoring of email, endpoint, identity, and network activity to detect phishing campaigns and suspicious remote administration behavior
• Managed Detection & Response (MDR): Rapid investigation and containment of phishing attacks and post-compromise activity using Microsoft Defender XDR
• Proactive Threat Hunting: Intelligence-driven hunts for emerging threat actor activity, including abuse of legitimate tools such as RMS and public file-sharing platforms
• Detection Engineering: Custom Microsoft Sentinel analytics and KQL detections continuously updated based on real-world threat intelligence.
• Incident Response & Containment: Fast response, forensic investigation, and remediation support to minimize business impact and accelerate recovery.

• CERT-EU – Cyber Brief 26-03 – February 2026
• UAC-0050 Targets European Financial Institution With Spoofed Domain and RMS Malware
• Mercenary Akula Hits Ukraine-Supporting Financial… | BlueVoyant